Linkbar

4 August 2018

Structuring Privacy through Confidentiality Obligations

Privacy has, of course, assumed centrestage in recent years with concerns about data and how to handle personal information becoming increasingly urgent. The Indian Supreme Court issued a decision in August 2017 which was unarguably in support of privacy although it recognised that the right could not be absolute.

At the time, I'd written in a piece in Business Standard saying: "The Supreme Court has done more for Indians in its judgment on privacy which was released yesterday than many had the temerity to hope for. The nine judges who heard the case have developed a comprehensive jurisprudence of privacy for India through six largely-concurring judgments appended to each other (with one of them having been signed by four of the judges). They have effectively harmonised the law which had earlier been developed on a case-by-case basis by providing a doctrinal basis for it, and, critically, they have held, without a shadow of doubt, that privacy is a fundamental right."

The months since the judgment was rendered have seen the emergence of an increasingly polarised debate about privacy which has, unfortunately, been marked by widely-accepted suggestions in some quarters about the legitimacy of structuring privacy protections based on consent instead of on rights. What this, if it were ultimately accepted, means is that being able to protect one's privacy would, in large part, be dependent on one's ability to impose confidentiality obligations on others and on one's willingness to adhere to non-disclosure commitments oneself.

In other words, a consent-based model of privacy protection would require those within its remit to possess a basic degree of legal literacy which would enable them to understand the implications of non-disclosure agreements, at the very least. This poses problems in a country where basic literacy itself is far from universal but, amongst the literate, it is not unachievable.

The structure of non-disclosure agreements or NDAs is fairly simple. The information sought to be protected is clearly defined in terms of its nature and the period during which it is disclosed; information either not listed or not disclosed within the disclosure period is generally not subject to contractual confidentiality obligations. A separate confidentiality period is also defined during which the receiving party is required to keep confidential information disclosed to it private. However, confidentiality obligations even during the confidentiality period are subject to agreed exclusions such as allowing necessary disclosure to law enforcement perhaps with notice to the disclosing party, and allowing any disclosure of what would otherwise have been confidential information to anyone in respect of information which is demonstrably in public domain but not as a result of the receiving party having breached its confidentiality obligations. Agreements also tend to contain either remedial or punitive provisions which are intended to come into play in case confidentiality obligations are breached; these provisions may involve monetary reparation, indemnification, or some other arrangement which the parties agree to.

Provided one doesn't fall foul of the 1872 Contract Act, Indian law allows parties a great deal of leeway to structure confidentiality obligations in a manner that makes sense to them. There are, however, a few statutes which recognise privacy as a right and which could be considered to impose supra-contractual statutory requirements on to parties. For example, Section 23 of the 2017 Mental Healthcare Act begins by stating: “A person with mental illness shall have the right to confidentiality in respect of his mental health, mental healthcare, treatment and physical healthcare,” and then goes on to impose specific obligations on certain people.

The effect of statutory provisions such those recognising the rights of people with mental healthcare concerns to confidentiality is that, in some cases, individuals are granted the option of choosing how to structure their privacy requirements within the framework of basic rights which they, hopefully, cannot simply sign away in toto. This helps level the field in cases where the power dynamic between parties is so skewed that “consent” becomes meaningless.

It is perhaps important that we inch towards developing a stronger framework which recognises limited choice within rights rather than one which could potentially legitimise unlimited choice despite rights. Ultimately, in a world rife with choice inhibition, we shouldn't be able to sign away, possibly by oversight, what should be inalienable rights.

Credit

Author

Subscribe in a Reader

Archives

Art and Indian Copyright Law: A Statutory Reading

A look at how the Indian Copyright Act, 1957, as amended in 2012, interacts with art (other than films and sound recordings), and, in particular, with Indian art. The first part of this text comprises a feminist and post-colonial reading of the Indian copyright statute while later parts focus on interpreting the provisions of the statute in relation to art.

The Bollywood Amendments (2010-2012)

An examination of the provisions of the 2012 amendments to the 1957 Indian Copyright Act which affect the film and music industry. The paper takes into consideration the factual background in which the amendments were made and explores whether they are likely to realise their objectives.

"IN Content Law" is a personal blog which contains the views of its author, Nandita Saikia, alone unless otherwise explicitly stated. The author of the blog may have advised clients on subjects relating to those dealt with in this blog. However, the contents of this blog are not intended to reflect the opinion or position of any person (other than the author) unless otherwise explicitly stated.

The posts on this blog relate to copyright and content law from an Indian perspective. They are not professional advice, and should not be considered or construed as such. No action should be taken or omitted on the basis of the contents of this blog.

This blog neither creates an attorney-client relationship between the author and any visitor(s) or any other person(s), nor does it seek to do so. The material contained herein is solely for the purpose of academic discussion and is accessible on an as-is basis.

No representations or warranties are made as to accuracy, impartiality or fitness of the material on this blog for any use, and the author shall not be liable in any manner to any extent for the consequences of any action taken on the basis of any material herein. Further, no representations or warranties of any nature are made regarding any material which may be linked to from this blog, and the author shall not be responsible for the contents thereof.Revisions: The posts on this blog may be revised from time-to-time for editorial or other purposes without each revision being marked in the post itself.

Privacy: No comments made on this blog OR mail or documentation sent to the author by any person in connection with this blog (i.e. "Information") shall be treated as being private or confidential, with the exception of the eMail address of the sender. By sending / transmitting any Information directly to the author or by way of a blog comment, the sender authorises the author to use and/or reproduce it for ANY purpose she desires at any place or time. All senders / potential senders are requested to contact the author if they have any privacy concerns, preferably, before sending / transmitting any Information.